Best method to permit SAML auth and Radius for Globalprotect at the same time?

[mannix]

Greetings all, I hope you can help me. 

I currently have Globalprotect set up on a single firewall - both portal and gateway.  We're using Radius for authentication, it is working well. 

We want to transition to SAML.  For testing purposes, we'd like to have SAML configured for a specific test user (or group), while leaving the current authentication scheme in place. 

Reordering "Client authentication" does not do it - if I put "SAML-GP" in the first position, SAML works, but no one else can authenticate.  I'm not sure I understand why client authentication order can be changed, but that's the behavior I'm getting. 

I'd RATHER not re-ip everything.  I'm thinking that a separate portal with different public IP is the answer; do I have to add a second gateway, too?  

I don't THINK I do, if I simply specify the current gateway in the portal config. 

Thoughts?  Am I overcomplicating things?

Thanks!

Iain

[Raido_Rattameister]

If you move SAML to the top then SAML takes precedence because your OS type is "any".

You can't use both SAML and RADIUS on same portal/gateway at the same time for different groups of users.

[mannix]

Thanks very much!  

Can I use a different portal for initial auth, then continue with my current gateway?  

Iain

[Raido_Rattameister]

Yes you can.

Keep portal as is and set up new gateway.

Using user or group membership point some users to new gateway.

[Brandon_Wertz]

---

@mannix wrote:

Greetings all, I hope you can help me. 

I currently have Globalprotect set up on a single firewall - both portal and gateway.  We're using Radius for authentication, it is working well. 

We want to transition to SAML.  For testing purposes, we'd like to have SAML configured for a specific test user (or group), while leaving the current authentication scheme in place. 

Reordering "Client authentication" does not do it - if I put "SAML-GP" in the first position, SAML works, but no one else can authenticate.  I'm not sure I understand why client authentication order can be changed, but that's the behavior I'm getting. 

I'd RATHER not re-ip everything.  I'm thinking that a separate portal with different public IP is the answer; do I have to add a second gateway, too?  

I don't THINK I do, if I simply specify the current gateway in the portal config. 

Thoughts?  Am I overcomplicating things?

Thanks!

Iain

---

We've recently switched to SAML auth for our GP, and we're told that if using SAML for auth that is the only auth mechanism that can be used.  So no matter how many mechanism you use in an auth profile if SAML is there only SAML will be used.

Not too sure how accurate that is, but that's what we were told from our SE.

[mannix]

What about the inverse - adding a portal, and within that portal, configure my existing external gateway?

I'm trying to create a situation where I can have test users authenticate with saml/Azure, without impacting our existing users. 

My thought was to create a second portal, with a different public IP/natted to a loopback.  Check "Generate cookie for authentication override" in the authentication portion of the portal config. 

That way, I can configure portal2 to use SAML, other users will be none the wiser. 

What am I missing?  I _THINK_ this will work.  

Thanks!

Iain